e365bc2dcb
This CL fixes a bug that allowed calls to Array.p.shift on zero-length arrays where the 'length' is read-only without throwing a TypeError. R=bmeurer@chromium.org, jgruber@chromium.org Bug: chromium:882233 Change-Id: Ib129ab4c4f4f233e7bb553effa77539badfbe26e Reviewed-on: https://chromium-review.googlesource.com/1215164 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Simon Zünd <szuend@google.com> Cr-Commit-Position: refs/heads/master@{#55746}
33 lines
872 B
JavaScript
33 lines
872 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --opt
|
|
|
|
// Intended to test bug [882233] on TF inlined (js-call-reducer) path.
|
|
|
|
function shift_array() {
|
|
let array = [];
|
|
Object.defineProperty(array, 'length', {writable : false});
|
|
return array.shift();
|
|
}
|
|
|
|
assertThrows(shift_array);
|
|
assertThrows(shift_array);
|
|
%OptimizeFunctionOnNextCall(shift_array);
|
|
assertThrows(shift_array);
|
|
assertOptimized(shift_array);
|
|
|
|
|
|
function shift_object() {
|
|
let object = { length: 0 };
|
|
Object.defineProperty(object, 'length', {writable : false});
|
|
return object.shift();
|
|
}
|
|
|
|
assertThrows(shift_object);
|
|
assertThrows(shift_object);
|
|
%OptimizeFunctionOnNextCall(shift_object);
|
|
assertThrows(shift_object);
|
|
assertOptimized(shift_object);
|